Executive brief
DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security flaw in its font management module allows logged-in users to delete files they should not have access to. By submitting a specially crafted request, an attacker can delete critical system or application files, potentially leading to data loss or a complete shutdown of the service.
Technical details
A path traversal vulnerability exists in the font management module of DataEase prior to version 2.10.24. The root cause is the lack of sanitization for the 'fileTransName' field during font record creation via the '/de2api/typeface/create' endpoint. When a font record is subsequently deleted via '/de2api/typeface/delete/{id}', the backend retrieves the stored 'fileTransName' and concatenates it directly with the font storage directory path before passing it to 'FileUtils.deleteFile()'. An authenticated attacker can exploit this by providing a payload containing traversal sequences (e.g., '../../../../') to delete arbitrary writable files within the application container. This can result in a denial of service or loss of application data. The issue is resolved in version 2.10.24.
Affected products
- DataEase DataEase < 2.10.24
Timeline
- 2026-06-18: patched: Fixed in version 2.10.24
- 2026-06-18: advisory: GitHub Security Advisory GHSA-r99p-w8fc-93g6 published
- 2026-07-07: disclosed: CVE-2026-55631 published to NVD